American Civil Liberties Union

The New York Times and Propublica jointly published an editorial last week entitled, “That’s Not My Phone, It’s My Tracker.” The authors review the sorry state of cell phone location privacy, raise and dismiss privacy-protecting options such as regularly removing the battery, or living without a phone, and conclude that what we should fight back linguistically at least, by calling these devices “trackers” rather than phones.

One of the biggest problems with protecting privacy in the United States is that, almost alone in the advanced-industrial world, we do not have an overarching privacy law that codifies the basic privacy principles that are accepted around the world as the gold standard for protecting this human right. 

Instead, the United States pursues a sector-by-sector approach to privacy. The result is that our privacy protections vary wildly according to area. We have some (inadequate) protections for our health and financial data, very few protections for our commercial transactions, and very rigorous protections for our video rental records. 

British Airways made headlines in Britain last week with reports that it is planning to do internet searches on customers in order to provide them with a “personal touch.” As a BA spokesperson explained,

We’re essentially trying to recreate the feeling of recognition you get in a favourite restaurant when you’re welcomed there, but in our case it will be delivered by thousands of staff to millions of customers. This is just the start—the system has a myriad of possibilities for the future.

A few links that have caught our eye this past week:

Paul Rosenzweig has posted a nice piece on Lawfare on the reasons to be skeptical of the need for cybersecurity regulation. He breaks cybersecurity down into its constituent parts (as we have urged) of cybercrime, cyber espionage, and truly catastrophic “digital Pearl Harbor” attacks. He suggests that the first two do not justify regulation, and (like us) is skeptical about the degree of risk of the third. In explaining that skepticism, he provides an elegant analysis of the electric grid, the taking down of which is a frequent cyber-attack scenario, and makes the point that the pro-regulation viewpoint “mistakes vulnerability for risk”—in other words, there can be a vulnerability in a system, but still a low risk that anyone will actually be able to or try to exploit it.